18.5. LDAP サーバーの構築例

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/dnszone.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org

pidfile         /var/run/slapd.pid
argsfile        /var/run/slapd.args

# Load dynamic backend modules:
modulepath      /usr/lib/openldap
moduleload      back_bdb.la
# moduleload    back_bdb.la
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# BDB database definitions
#######################################################################

database        bdb
suffix          dc=localhost,dc=localdomain
rootdn          cn=Manager,dc=localhost,dc=localdomain

# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw          {SHA}s1qM/cSaS+X0cNcg1/AdnYiIEQg=
password-hash   {SHA}

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/openldap-data

# Indices to maintain
index   objectClass     eq

# comment
dn: distinguished name
attrdesc: attrvalue
attrdesc: attrvalue

# comment
dn: distinguished name
attrdesc: attrvalue
attrdesc: attrvalue

 ...

dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: example
o: Example Corporation

dn: cn=Manager,dc=example,dc=com
objectClass: organizationalRole
cn: Manager

$ ldapadd -h localhost -x -W -D "cn=Manager,dc=example,dc=com" -f suffix.ldif

dn: ou=Sales,dc=example,dc=com
objectClass: organizationalUnit
ou: Sales

dn: ou=Development,dc=example,dc=com
objectClass: organizationalUnit
ou: Development

$ ldapadd -h localhost -x -D "cn=Manager,dc=example,dc=com" -W -f busho.ldif

dn: uid=hayashi,ou=Sales,dc=example,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: hayashi
cn: 林 一朗
sn: 林
givenName: 一朗
mail: hayashi@example.com

$ ldapadd -h localhost -x -D "cn=Manager,dc=example,dc=com" -W -f sales-people-hayashi-utf8.ldif

dn: uid=taro,ou=Development,dc=example,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: taro
cn: 鈴木 太郎
sn: 鈴木
givenName: 太郎
mail: taro@example.com
shadowLastChange: 11414
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 2000
gidNumber: 2000
homeDirectory: /home/taro
userPassword: {SSHA}WAAvvjkaGJFNhneiOT3WXwKwN+aCFtRI

$ ldapadd -h localhost -x -D "cn=Manager,dc=example,dc=com" -W -f development-people-suzuki-utf8.ldif

# miniuni
# authconfig-tui

uri ldap://192.168.0.10/
base dc=example,dc=com

passwd:     files nisplus ldap
shadow:     files nisplus ldap
group:      files nisplus ldap

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet
use_uid
session     required      pam_unix.so
session     optional      pam_ldap.s

$ id taro
uid=2000(taro) gid=2000 groups=2000